strange spyware / adware problem

[byroncheng]

Hi,
Recently I've been getting random pop-ups while using IE,
when I visit popular sites such as pcworld.com, sony.com,
clubmonaco.com. The ads do not appear when IE is not in
use. I've ran deep scans with updated versions of ad-
aware, spybot, microsoft anti-spyware, sunbelt counter-
spy, and even norton anti-virus in safe mode but could not
find anything.

Because the ads are have random titles in the titlebar,
and does not seem to be particularly a single ad, so I
could not determine what might have caused it.(although
ironically a small pop-up about "pop-up ads" and internet
security seems to appear most often and says
z1.adserver.com on the titlebar)

In addition, the XP's built-in pop up blocker seems to get
automatically turned OFF, even when I turned it on and
have set it to block ALL pop-ups.

any solutions? or advice?

greatly appreciated.

 

[Frank]

I wish this reply was giving a solution but unfortuntely
I'm just letting you know that you are not alone. I'm
having the exact same thing happen and it's been about a
week. I've also tried 3-4 different spyware programs with
no results. Hopefully someone will have a fix for us.

 

[plun]

I wish this reply was giving a solution but unfortuntely
I'm just letting you know that you are not alone. I'm
having the exact same thing happen and it's been about a
week. I've also tried 3-4 different spyware programs with
no results. Hopefully someone will have a fix for us.

Hi

This tool is brand new, perhaps worth a try.

http://www.europe.f-secure.com/blacklight/

 

[byroncheng]

I think i found out what it is... I suspect its an adware
called iedriver. The only spyware remover that caught
this was webroot spysweeper 3.5. A fully-functionable
version is available for download at www.webroot.com

I'm still uncertain if this is really the culprit, since
those incidents are at random and difficult to reproduce
for testing... I'll repost if I find something else.

One other small thing i found out, the XP SP2 pop-up
blocker becomes disabled when the first pop-up ad
initiates, but not when IE first starts up.

Judging from all the symptoms it seems very likely that
it is caused by the iedriver spyware.

 

[byroncheng]

I'm sorry to say, the solution mentioned above it didn't
work :-( still stumped :'-(

 

[Ron Chamberlin]

Hi Byron,
Lets do two things here:
1. Send in a Suspected Spyware Report from MWAS;

2. Boot into Safe Mode (F8) at startup;
Empty your temporary files AND your Temporary Internet Files C:\Documents
and Settings\Username\Local Settings\Temporary Internet Files folder ;
Run the scan while in safe mode;
If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck any
BHO's that you don't recognize.

Ron Chamberlin
MS-MVP